Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   "Lawrence, Stephen" <slawrence@tresys.com>
To:     SELinux Refpolicy <selinux-refpolicy@vger.kernel.org>
Subject: [PATCH 2/2] miscfiles: reading certs allows map permission also
Thread-Topic: [PATCH 2/2] miscfiles: reading certs allows map permission also
Thread-Index: AQHVrGrw+hq5LfDLdkaJM0v7JCNbIg==
Date:   Fri, 6 Dec 2019 19:25:37 +0000
Message-ID: <20191206192526.8129-3-slawrence@tresys.com>
References: <20191206192526.8129-1-slawrence@tresys.com>
In-Reply-To: <20191206192526.8129-1-slawrence@tresys.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-mailer: git-send-email 2.21.0
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: b52e0e92-b4a9-42d8-d6c6-08d77a821244
x-ms-traffictypediagnostic: DM5PR15MB1308:
x-microsoft-antispam-prvs: <DM5PR15MB13088F9F0AF06FFF0C9FBC44D95F0@DM5PR15MB1308.namprd15.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:1284;
x-forefront-prvs: 0243E5FD68
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(4636009)(396003)(136003)(346002)(39840400004)(366004)(376002)(189003)(199004)(52116002)(99286004)(2616005)(76176011)(316002)(186003)(36756003)(1076003)(50226002)(6506007)(71190400001)(102836004)(71200400001)(508600001)(66446008)(64756008)(66556008)(66476007)(66946007)(8936002)(5660300002)(6486002)(81166006)(8676002)(6512007)(26005)(81156014)(86362001)(305945005)(4744005)(2906002)(6916009);DIR:OUT;SFP:1102;SCL:1;SRVR:DM5PR15MB1308;H:DM5PR15MB1450.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: tresys.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: +X8TIY9xSIO9iIKqKzc5ExEUmzdnXQMXuigVwUihrmyPlKT0RHeIyW7YUzEfp0qNx/oInWAwwzhUWaBcTKY8H7duLbVK1LPcM0h7GsOGqqD7m0YsvvnySt9F/GIo7GFht7WNpb6w08Y/kCzukNbPESmiGKlWfs9ArcyfWYIETiekFvkEzSpgW79D2aKjiT5P0slr//2u4Z57I+jvMciOle7HsbFpdhHyVcbS0Z5g6YANxnQSlwOdCdTHu872pfmDYDDWkCgS28xE4rp5r+vOGjLV2MQxe/6NDPVj28wR2vcqBLsnQtE5N8I6kcENh5eiJt7xgPvDSNs9zpYUJ+gDQ52/G10bFWcBFqR1yumlFCHuM7yuyuJdjeS04OTF8zVIqXdzikJNjMwYAbkC61N4WPtxQPbTjVE2vZExIIr+jqlf7N+wstEtcKIYoWszxWWy
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: tresys.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b52e0e92-b4a9-42d8-d6c6-08d77a821244
X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Dec 2019 19:25:37.2790
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a0d45667-6c07-4e88-868f-4ac9af95c7ed
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: sJTPxazjcXddJCl51HnabIQSKRc1k1+sdwkNUcLf3/psFBPrIAOf0gOP8OjLY4ZOqPi93rVaDEE5xsuZb2bQnQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR15MB1308
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk
List-ID: <selinux-refpolicy.vger.kernel.org>
X-Mailing-List: selinux-refpolicy@vger.kernel.org

---
 policy/modules/system/miscfiles.if | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/policy/modules/system/miscfiles.if b/policy/modules/system/mis=
cfiles.if
index df11794a..4ff82afb 100644
--- a/policy/modules/system/miscfiles.if
+++ b/policy/modules/system/miscfiles.if
@@ -107,6 +107,7 @@ interface(`miscfiles_read_all_certs',`
=20
 	allow $1 cert_type:dir list_dir_perms;
 	read_files_pattern($1, cert_type, cert_type)
+	allow $1 cert_type:file map;
 	read_lnk_files_pattern($1, cert_type, cert_type)
 ')
=20
@@ -128,6 +129,7 @@ interface(`miscfiles_read_generic_certs',`
=20
 	allow $1 cert_t:dir list_dir_perms;
 	read_files_pattern($1, cert_t, cert_t)
+	allow $1 cert_t:file map;
 	read_lnk_files_pattern($1, cert_t, cert_t)
 ')
=20
--=20
2.21.0